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Amendments to the Claims : 

The listing of claims will replace all prior versions, and listings, of claims 
in the application: 

Listing of Claims : 

1. (Previously presented) A method for selectively shadowing only 
accesses to external storage media connected to a computer, the method 
comprising: detecting a data access to an external storage medium; and writing a 
copy of the accessed data to a storage location other than the external storage 
medium; wherein the detecting step comprises intercepting an I/O request from 
the computer to an external storage media drive in which the external storage 
media is inserted. 

2. (Previously presented) The method of claim 1 wherein the access is a 
write operation. 

3. (Previously presented) The method of claim 1 wherein the access is a 
read operation. 

4. (Canceled) 

5. (Previously Presented) The method of claim 1 wherein the I/O request is 
one of the group consisting of a file open or creation request, a write request, a 
file close request, a file system control request and a read request. 
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6. (Previously presented) The method of claim 5 further comprising: 
providing a proxy handler for the I/O request; and executing the proxy handler, 
in response to the detecting step. 

7. (Previously presented) The method of claim [4] 1 wherein the computer 
runs under an operating system and the I/O request is one of the group 
consisting of IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE, 
IRP_MJ_FILE_SYSTEM_CONTROL and IRP_MJ_READ packets. 

8. (Previously presented) The method of claim 7 further comprising: 
providing proxy handlers for the IRP_MJ_CREATE, IRP_MJ„WRITE, 
IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONT- ROL packets; and 
executing one of the proxy handlers, in response to the detecting step when the 
I/O request is a respective packet selected from the group consisting of 
IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ„CLOSE and 
IRP_MJ_FILE_SYSTEM_CONTROL packets. 

9. (Previously presented) The method of claim 8 further comprising: 
providing a proxy handlers for the IRP_MJ_READ packet; and executing the 
proxy handlers for the IRP_MJ_READ packet, in response to the detecting step 
when the I/O request is an IRP_MJ_READ packet. 

10. (Previously presented) The method of claim 1 wherein the storage 
location other than the external storage media is a protected storage location. 

11. (Previously presented) The method of claim 1 further comprising: 
writing the data to the external storage medium after the step of writing a copy 
of the data to a storage location other than the external storage medium. 
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12. (Previously presented) The method of claim 1 further comprising: 
attaching to one or more file systems connected to an external storage media 
drive in which the external storage medium is inserted; and wherein the 
detecting step comprises intercepting I/O requests to the one or more file 
systems. 

13. (Previously presented) The method of claim 1 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a CD, a 
removable hard disk drive, and a zip disk drive. 

14. (Previously presented) The method of claim 1 further comprising: 
collecting the copy into a database where similar copies are collected; and 
querying the database. 

15. (Previously Presented) A method for selectively shadowing only 
accesses to external storage media connected to a computer, the method 
comprising: 

detecting a data access to an external storage medium; 
writing a copy of the accessed data to a storage location other than the 
external storage medium; 

collecting the copy into a database where similar copies are collected; and 
querying the database; 

wherein the detecting step comprises intercepting an I/O request from the 
computer to an external storage media drive in which the external storage media 
is inserted; 

wherein the database comprises records, each record comprising the 
copied data, a file name associated with the data, an identification of who 
initiated the data access, a station ID, and when the access was made. 
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16. (Previously presented) The method of claim 14 wherein the computer is 
connected to a computer network, and the detecting and copying steps are 
performed at the computer, and the collecting and querying steps are performed 
at another computer on the network. 

17. (Previously presented) The method of claim 14 wherein the collecting 
and querying steps are performed by a user with administrator privileges. 

18. (Currently Amended) A computer readable storage medium on which 
is embedded computer software, the software performing a method, the method 
comprising: detecting a data access to an external storage medium; and writing a 
copy of the accessed data to a storage location other than the external storage 
medium; wherein the detecting step comprises intercepting an I/O request from 
the computer to an external storage media drive in which the external storage 
media is inserted. 

19. (Currently Amended) The computer readable storage medium of claim 
18 wherein the access is a write operation. 

20. (Canceled) 

21. (Currently Amended) The computer readable storage medium of claim 
18 wherein the computer system runs under an operating system and the I/O 
request is one of the group consisting of IRP_MJ_CREATE, IRP_MJ_WRITE, 
IRP_MJ_CLOSE, IRP_MJ_FILE_SYSTEM_CONTROL and IRP_MJ_READ 
packets. 

22. (Previously presented) An apparatus for selectively shadowing only 
accesses to external storage media connected to a computer, the apparatus 
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comprising: a detector that intercepts I/O requests from the computer to an 
external storage media drive in which the external storage media is inserted; 
and a storage, other than the external storage medium, connected to the 
detector, in which a copy of the accessed data is written. 

23. (Previously presented) The apparatus of claim 22 further comprising 
one or more proxy handlers connected to the detector, wherein the proxy 
handlers handle certain I/O requests. 

24. (Previously presented) The apparatus of claim 23 wherein the certain 
I/O requests comprise IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE 
and IRP_MJ_FILE_SYSTEM_CONTROL packet. 

25. (Previously presented) The apparatus of claim 24 wherein the certain 
I/O requests further comprise an IRP_MJ_READ packet. 

26. (Previously presented) The apparatus of claim 23 further comprising: a 
list, connected to at least some of the one or more proxy handlers, in which file 
identifiers are contained. 

27. (Previously presented) The apparatus of claim 26 wherein the file 
identifiers are IRP.FsContext values. 

28. (Previously presented) The apparatus of claim 23 further comprising: 
one or more counters, connected to at least some of the one or more proxy 
handlers, by which certain file operations are counted. 
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29. (Previously presented) The apparatus of claim 23 wherein the computer 
runs under an operating system, and the one or more proxy handlers are 
connected to I/O request packet drivers supplied by the operating system. 

30. (Canceled) 

31. (Previously Presented) The method of claim 1 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a writable 
CD, a removable hard disk drive, and a zip disk drive. 

32. (Currently Amended) The computer readable storage medium of claim 
18 wherein the external storage medium is selected from the group consisting of 
a floppy disk; a writable CD, a removable hard disk drive, and a zip disk drive. 

33. (Previously presented) The apparatus of claim 22 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a writable 
CD, a removable hard disk drive, and a zip disk drive. 
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